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Abstract 

We extend the "method of multiphcities" to get the following results, of interest in combi- 
natorics and randomness extraction. 

1. We show that every Kakeya set (a set of points that contains a line in every direction) in 

must be of size at least g"/2". This bound is tight to within a 2 + o(l) factor for every 
n as g — > oo, compared to previous bounds that were off by exponential factors in n. 

2. We give improved randomness extractors and "randomness mergers". Mergers are seeded 
functions that take as input A (possibly correlated) random variables in {0, 1}^ and a short 
random seed and output a single random variable in {0, 1}^ that is statistically close to 
having entropy {1 — S) ■ N when one of the A input variables is distributed uniformly. The 
seed we require is only (1/6) ■ logA-bits long, which significantly improves upon previous 
construction of mergers. 

3. Using our new mergers, we show how to construct randomness extractors that use loga- 
rithmic length seeds while extracting 1 — o(l) fraction of the min-entropy of the source. 
Previous results could extract only a constant fraction of the entropy while maintaining 
logarithmic seed length. 

The "method of multiplicities" , as used in prior work, analyzed subsets of vector spaces over finite 
fields by constructing somewhat low degree interpolating polynomials that vanish on every point 
in the subset with high multiplicity. The typical use of this method involved showing that the 
interpolating polynomial also vanished on some points outside the subset, and then used simple 
bounds on the number of zeroes to complete the analysis. Our augmentation to this technique 
is that we prove, under appropriate conditions, that the interpolating polynomial vanishes with 
high multiplicity outside the set. This novelty leads to significantly tighter analyses. 

To develop the extended method of multiplicities we provide a number of basic technical 
results about multiplicity of zeroes of polynomials that may be of general use. For instance, 
we strengthen the Schwartz-Zippel lemma to show that the expected multiplicity of zeroes of a 
non-zero degree d polynomial at a random point in S"", for any finite subset S of the underlying 
field, is at most d/\S\ (a fact that does not seem to have been noticed in the CS literature 
before). 
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1 Introduction 



The goal of this paper is to improve on an algebraic method that has lately been applied, quite 
effectively, to analyze combinatorial parameters of subsets of vector spaces that satisfy some given 
algebraic/geometric conditions. This technique, which we refer to as as the polynomial method (of 
combinatorics), proceeds in three steps: Given the subset K satisfying the algebraic conditions, one 
first constructs a non-zero low-degree polynomial that vanishes on K. Next, one uses the algebraic 
conditions on K to show that the polynomial vanishes at other points outside K as well. Finally, one 
uses the fact that the polynomial is zero too often to derive bounds on the combinatorial parameters 
of interest. The polynomial method has seen utility in the computer science literature in works on 
"list-decoding" starting with Sudan [Sud97] and subsequent works. Recently the method has been 
applied to analyze "extractors" by Guruswami, Umans, and Vadhan [GUVOTj . Most relevant to this 
current paper are its applications to lower bound the cardinality of "Kakeya sets" by Dvir |Dvi08] , 
and the subsequent constructions of "mergers" and "extractors" by Dvir and Wigderson |DW08] . 
(We will elaborate on some of these results shortly.) 

The method of multiplicities, as we term it, may be considered an extension of this method. In 
this extension one constructs polynomials that vanish with high multiplicity on the subset K. This 
requirement often forces one to use polynomials of higher degree than in the polynomial method, 
but it gains in the second step by using the high multiplicity of zeroes to conclude "more easily" that 
the polynomial is zero at other points. This typically leads to a tighter analysis of the combinatorial 
parameters of interest. This method has been applied widely in list-decoding starting with the work 
of Guruswami and Sudan [GS99j and continuing through many subsequent works, most significantly 
in the works of Parvaresh and Vardy |PV05j and Guruswami and Rudra |GR06j leading to rate- 
optimal list-decodable codes. Very recently this method was also applied to improve the lower 
bounds on the size of "Kakeya sets" by Saraf and Sudan |SS08| . 

The main contribution of this paper is an extension to this method, that we call the extended method 
of multiplicities, which develops this method (hopefully) fully to derive even tighter bounds on the 
combinatorial parameters. In our extension, we start as in the method of multiplicities to construct 
a polynomial that vanishes with high multiplicity on every point of K. But then we extend the 
second step where we exploit the algebraic conditions to show that the polynomial vanishes with 
high multiplicity on some points outside K as well. Finally we extend the third step to show that 
this gives better bounds on the combinatorial parameters of interest. 

By these extensions we derive nearly optimal lower bounds on the size of Kakeya sets and qual- 
itatively improved analysis of mergers leading to new extractor constructions. We also rederive 
algebraically a known bound on the list-size in the list-decoding of Reed-Solomon codes. We 
describe these contributions in detail next, before going on to describe some of the technical obser- 
vations used to derive the extended method of multiplicities (which we believe are of independent 
interest). 

1.1 Kakeya Sets over Finite Fields 

Let ¥q denote the finite field of cardinality q. A set X C is said to be a Kakeya set if it "contains 
a line in every direction". In other words, for every "direction" b G there should exist an "offset" 
a G Fq such that the "line" through a in direction b, i.e., the set {a + th\t £ Fg}, is contained in 
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K. A question of interest in combinatorics /algebra/geometry, posed originally by Wolff |Wol99] . 
is: "What is the size of the smallest Kakeya set, for a given choice of q and n?" 

The trivial upper bound on the size of a Kakeya set is and this can be improved to roughly 
2^q"' (precisely the bound is i^n^r'f' + see |SS08j for a proof of this bound due to Dvir). 

An almost trivial lower bound is g"/^ (every Kakeya set "contains" at least lines, but there are 
at most \K'\^ lines that intersect K at least twice). Till recently even the exponent of q was not 
known precisely (see |Dvi08| for details of work prior to 2008). This changed with the result of 
|Dvi0 8] (combined with an observation of Alon and Tao) who showed that for every n, \K\ > Cnq"", 
for some constant c„ depending only on n. 

Subsequently the work |SS08j explored the growth of the constant c„ as a function of n. The result 
of |Dvi08j shows that Cn > and |SS08j improve this bound to show that c„ > 1/(2.6)". This 

still leaves a gap between the upper bound and the lower bound and we effectively close this gap. 

Theorem 1 If K is a Kakeya set in then \K\ > ^q^. 

Note that our bound is tight to within a 2 + o(l) multiplicative factor as long as q = w(2") and in 
particular when n = 0(1) and q oo. 

1.2 Randomness Mergers and Extractors 

A general quest in the computational study of randomness is the search for simple primitives that 
manipulate random variables to convert their randomness into more useful forms. The exact notion 
of utility varies with applications. The most common notion is that of "extractors" that produce 
an output variable that is distributed statistically close to uniformly on the range. Other notions 
of interest include "condensers", "dispersers" etc. One such object of study (partly because it is 
useful to construct extractors) is a "randomness merger". A randomness merger takes as input 

A, possibly correlated, random variables Ai,...,Aa, along with a short uniformly random seed 

B, which is independent of Ai, . . . , Aa, and "merges" the randomness of Ai, . . . , Aa. Specifically 
the output of the merger should be statistically close to a high-entropy-rate source of randomness 
provided at least one of the input variables Ai , . . . , Aa is uniform. 

Mergers were first introduced by Ta-Shma |TS96a| in the context of explicit constructions of ex- 
tractors. A general framework was given in |TS96aj that reduces the problem of constructing good 
extractors into that of constructing good mergers. Subsequently, in |LRVW03] . mergers were used 
in a more complicated manner to create extractors which were optimal to within constant factors. 
The mergers of |LRVW03j had a very simple algebraic structure: the output of the merger was a 
random linear combination of the blocks over a finite vector space. The [LRVWO^ merger analysis 
was improved in |DS07] using the connection to the finite field Kakeya problem and the (then) 
state of the art results on Kakeya sets. 

The new technique in [Dvi08] inspired Dvir and Wigderson [DW08j to give a very simple, algebraic, 
construction of a merger which can be viewed as a derandomized version of the [LRVWO^ merger. 
They associate the domain of each random variable Aj with a vector space F^. With the A-tuple 
of random variables Ai, . . . , Aa, they associate a curve C : F^ ^ of degree < A which 'passes' 
through all the points Ai, . . . , Aa (that is, the image of C contains these points). They then select 
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a random point u £¥q and output C{u) as the "merged" output. They show that if g > poly(A-n) 
then the output of the merger is statisticahy close to a distribution of entropy-rate arbitrarily close 
to 1 on F^. 

While the polynomial (or at least linear) dependence of g on A is essential to the construction 
above, the requirement q > poly(n) appears only in the analysis. In our work we remove this 
restriction to show: 

Informal Theorem [Merger]: For every A,q the output of the Dvir-Wigderson merger is close 
to a source of entropy rate 1 — log^A. In particular there exists an explicit merger for A sources (of 
arbitrary length) that outputs a source with entropy rate 1 — 6 and has seed length (1/5) ■ log(A/e) 
for any error e. 

The above theorem (in its more formal form given in Theorem [T7|) allows us to merge A sources 
using seed length which is only logarithmic in the number of sources and does not depend entirely 
on the length of each source. Earlier constructions of mergers required the seed to depend either 
linearly on the number of blocks [LRVWOSl IZucOTj or to depend also on the length of each block 
|DW08j . 

One consequence of our improved merger construction is an improved construction of extractors. 
Recah that a {k, e)-extractor E : {0, 1}" x {0, l}'^ {0, 1}™ is a deterministic function that takes 
any random variable X with min-entropy at least k over {0, 1}" and an independent uniformly 
distributed seed Y G {0, l}*^ and converts it to the random variable E{X, Y) that is e-close in 
statistical distance to a uniformly distributed random variable over {0, l}*". Such an extractor is 
efficient if E is polynomial time computable. 

A diverse collection of efficient extractors are known in the literature (see the survey |Sha02] 
and the more recent |GUV07[ IDW08| for references) and many applications have been found for 
explicit extractor is various research areas spanning theoretical computer science. Yet all previous 
constructions lost a linear fraction of the min-entropy of the source (i.e., acheived m = (1 — e)/c 
for some constant e > 0) or used super-logarithmic seed length {d = u!{logn)). We show that our 
merger construction yields, by combining with several of the prior tools in the arsenal of extractor 
constructions, an extractor which extracts a 1 — ppiyjog^n) fraction of the minentropy of the source, 
while still using 0(log n)-length seeds. We now state our extractor result in an informal way (see 
Theorem [21] for the formal statement). 

Informal Theorem [Extractor]: There exists an explicit {k,e)- extractor for all min-entropies k 
with O(logn) seed, entropy loss 0(A;/polylog(n)) and error e = l/polylog(n), where the powers in 
the polylog(n) can be arbitrarily high constants. 

1.3 List-Decoding of Reed-Solomon Codes 

The Reed-Solomon list-decoding problem is the following: Given a sequence of points 

(ai,/3i),...,(Q„,/3n) e¥gX ¥q, 

and parameters k and t, find the list of all polynomials pi, . . . ,pL of degree at most k that agree 
with the given set of points on t locations, i.e., for every j G {1, . . . , L} the set {i\pj{ai) = Pi} has 

^The result we refer to in [Zuc07l Theorem 5.1] is actually a condenser (which is stronger than a merger). 
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at least t elements. The associated combinatorial problem is: How large can the list size, L, be for 
a given choice of k,t,n,q (when maximized over all possible set of distinct input points)? 

A somewhat nonstandard, yet reasonable, interpretation of the list-decoding algorithms of |Sud97t 
IGS99 j is that they give algebraic proofs, by the polynomial method and the method of multiplicities, 
of known combinatorial upper bounds on the list size, when t > \fhn. Their proofs happen also to 
be algorithmic and so lead to algorithms to find a list of all such polynomials. 

However, the bound given on the list size in the above works does not match the best known 
combinatorial bound. The best known bound to date seems to be that of Cassuto and Bruck |CB04] 
who show that, letting R = k/n and ^ = t/n, if 7^ > R, then the list size L is bounded by 0(:p3^) 
(in contrast, the Johnson bound and the analysis of |GS99| gives a list size bound of 0{ 

which is asymptotically worse for, say, 7 = (1 + 0{l))y/R and R tending to 0). In Theorem 1341 we 
recover the bound of |CB04| using our extended method of multiplicities. 

1.4 Technique: Extended method of multiphcities 

The common insight to all the above improvements is that the extended method of multiplicities can 
be applied to each problem to improve the parameters. Here we attempt to describe the technical 
novelties in the development of the extended method of multiplicities. 

For concreteness, let us take the case of the Kakeya set problem. Given a set C F^, the method 
first finds a non-zero polynomial P G Fg[Xi, . . . , X„] that vanishes with high multiplicity m on each 
point of K. The next step is to prove that P vanishes with fairly high multiplicity £ at every point 
in as well. This step turns out to be somewhat subtle (and is evidenced by the fact that the 
exact relationship between m and i is not simple). Our analysis here crucially uses the fact that 
the (Hasse) derivatives of the polynomial P, which are the central to the notion of multiplicity of 
roots, are themselves polynomials, and also vanish with high multiplicity at points in K. This fact 
does not seem to have been needed/used in prior works and is central to ours. 

A second important technical novelty arises in the final step of the method of multiplicities, where we 
need to conclude that if the degree of P is "small" , then P must be identically zero. Unfortunately 
in our application the degree of P may be much larger than q (or nq, or even q"'). To prove that it 
is identically zero we need to use the fact that P vanishes with high multiplicity at every point in 
Fq , and this requires some multiplicity-enhanced version of the standard Schwartz-Zippel lemma. 
We prove such a strengthening, showing that the expected multiplicity of zeroes of a degree d 
polynomial (even when d ^ q') at a random point in F^ is at most d/q (see Lemma E]). Using this 
lemma, we are able to derive much better benefits from the "polynomial method". Indeed we feel 
that this allows us to fully utilize the power of the polynomial ring F|j[X] and are not limited by 
the power of the function space mapping F^ to Fg. 

Putting these ingredients together, the analysis of the Kakeya sets follows easily. The analysis of 
the mergers follows a similar path and may be viewed as a "statistical" extension of the Kakeya 
set analysis to "curve" based sets, i.e., here we consider sets S that have the property that for 
a noticeable fraction points x G F^ there exists a low-degree curve passing through x that has a 
noticeable fraction of its points in S. We prove such sets must also be large and this leads to the 
analysis of the Dvir-Wigderson merger. 
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Organization of this paper. In Section [2] we define the notion of the multiplicity of the roots 
of a polynomial, using the notion of the Hasse derivative. We present some basic facts about 
multiplicities and Hasse derivatives, and also present the multiplicity based version of the Schwartz- 
Zippel lemma. In Section [3] we present our lower bounds for Kakeya sets. In Section |4] we extend 
this analysis for "curves" and for "statistical" versions of the Kakeya property. This leads to our 
analysis of the Dvir-Wigderson merger in Section [3 We then show how to use our mergers to 
construct the novel extractors in Section [6j Finally, in Section [71 we include the algebraic proof of 
the list-size bounds for the list-decoding of Reed-Solomon codes. 

Version history. This version of the paper adds a new section (Section [6]) constructing extractors 
based on the mergers given in the previous version of this paper (dated 15 January 2009). 

2 Preliminaries 

In this section we formally define the notion of "mutliplicity of zeroes" along with the companion 
notion of the "Hasse derivative". We also describe basic properties of these notions, concluding 
with the proof of the "multiplicity-enhanced version" of the Schwartz-Zippel lemma. 

2.1 Basic definitions 

We start with some notation. We use [n] to denote the set {!,..., n}. For a vector i = (ii, . . . , i„) 
of non-negative integers, its weight, denoted wt(i), equals X]j=i^i- 

Let F be any field, and ¥q denote the finite field of q elements. For X = {Xi, . . . , Xn), let F[X] be 
the ring of polynomials in Xi, . . . , Xn with coefficients in F. For a polynomial -P(X), we let Hp(X.) 
denote the homogeneous part of -P(X) of highest total degree. 

For a vector of non-negative integers i = (ii, . . . , let X' denote the monomial 0^=1 -^^^ ^ F[X]. 
Note that the (total) degree of this monomial equals wt(i). For n-tuples of non- negative integers i 
and j, we use the notation 

G)^nG:)- 

Note that the coefficient of Z'W"^' in the expansion of (Z -|- W)"" equals (j). 

Definition 2 ((Hasse) Derivative) For P(X.) G F[X] and non-negative vector i, the ith (Hasse) 

derivative of P, denoted p('^(X), is the coefficient of 1} in the 'polynomial P(X, Z)'^^P(X -|- Z) E 
F[X,Z]. 

Thus, 

P(X + Z) = ^P(^)(X)Z'. (1) 

i 

We are now ready to define the notion of the (zero-)multiplicity of a polynomial at any given point. 
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Definition 3 (Multiplicity) For P(X) € F[X] and a e F", the multiplicity of P at a e F", 

denoted mult(-P, a), is the largest integer M such that for every non-negative vector i with wt(i) < 
M, we have P(')(a) =0 (if M may he taken arbitrarily large, we set mult(P, a) = co). 



Note that mult(P, a) > for every a. Also, P(a) = if and only if mult(P, a) > 1. 

The above notations and definitions also extend naturally to a tuple P(X) = (Pi(X), . . . , Pm(X)) 
of polynomials with P^') G F[X]™ denoting the vector ((Pi)('\ . . . , (P^)'-'^)- In particular, we define 
mult(P, a) = miuj g[^]{ mult (Pj, a)}. 

The definition of multiplicity above is similar to the standard (analytic) definition of multiplicity 
with the difference that the standard partial derivative has been replaced by the Hasse derivative. 
The Hasse derivative is also a reasonably well-studied quantity (see, for example, |HKT081 pages 
144-155]) and seems to have first appeared in the CS literature (without being explicitly referred to 
by this name) in the work of Guruswami and Sudan GS99j . It typically behaves like the standard 
derivative, but with some key differences that make it more useful/informative over finite fields. For 
completeness we review basic properties of the Hasse derivative and multiplicity in the following 
subsections. 

2.2 Properties of Hasse Derivatives 

The following proposition lists basic properties of the Hasse derivatives. Parts (l)-(3) below are 
the same as for the analytic derivative, while Part (4) is not! Part (4) considers the derivatives of 
the derivatives of a polynomial and shows a different relationship than is standard for the analytic 
derivative. However crucial for our purposes is that it shows that the jth derivative of the ith 
derivative is zero if (though not necessarily only if) the (i + j)-th derivative is zero. 

Proposition 4 (Basic Properties of Derivatives) Let P(X),(5(X) G F[X]™ and let i, j he 

vectors of nonnegative integers. Then: 



Items 1 and 2 are easy to check, and item 3 follows immediately from them. For item 4, we expand 
P(X + Z + W) in two ways. First expand 




Proof 



P(X + (Z + W)) = J^p('')(x)(z + W)*^ 



k 
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On the other hand, we may write 

p((x + z) +w) = ^p(')(x + z)w' = YYj{^^^^Y^ (X)ZjW'. 

i i j 

Comparing coefficients of Z^W on both sides, we get the result. ■ 
2.3 Properties of Multiplicities 

We now translate some of the properties of the Hasse derivative into properties of the multiplicities. 

Lemma 5 (Basic Properties of multiplicities) // P(X) G F[X] and a G F" are such that 
mult(P, a) = m, then mult(p('\a) > m — wt(i). 

Proof By assumption, for any k with wt(k) < m, we have p('')(a) = 0. Now take any j 
such that wt(j) < m - wt(i). By item 3 of Proposition d (p('))(j)(a) = ('tj)p('+j)(a). Since 
wt(i +j) = wt(i) + wt(j) < m, we deduce that (p('))(j)(a) = 0. Thus mult(p('),a) > m - wt(i). ■ 

We now discuss the behavior of multiplicities under composition of polynomial tuples. Let X = 
{Xi,..., Xn) and Y = {Yi,..., Ye) be formal variables. Let P(X) = (Pi(X), . . . , Pm(X)) G F[X]'^ 
and Q(Y) = (Qi(y), . . . , Q„(y)) G F[Y]". We define the composition polynomial P o Q(Y) G 
F[Y]'" to be the polynomial P((5i(Y), . . . , Qn(Y)). In this situation we have the following propo- 
sition. 

Proposition 6 Let P(X), Q{Y) be as above. Then for any a G F^, 

mult(P o Q, a) > mult(P, (3(a)) • mult((5 - (5(a), a). 
In particular, since mult((3 — Q{a),a) > 1, we have mult(P oQ^a) > mult (P, (5(a)). 

Proof Let mi = mult(P, (5(a)) and m2 = mult((5 — (5(a), a). Clearly m2 > 0. If mi = the 
result is obvious. Now assume mi > (so that P{Q{a)) = 0). 



P(Q(a + Z)) = P Q(a) + ^ Q(')(a)Z' 



i^o 

p[Q(a)+ Q(')(a)Z' I since mult(g - Q(a), a) = ms > 

\ wt(i)>m2 J 

P (g(a) + h{Z)) where h{Z) = E^t^m^ Q^'Ha)Z' 

P(Q(a)) + ^p(-i)(g(a))/i(Z)j 

Y P^j^(<9(a))/i(Z)j since mult(P, Q(a)) = mi > 

wt(j)>mi 
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Thus, since each monomial Z' appearing in h has wt(i) > m2, and each occurrence of /i(Z) in 
P{Q{a + Z)) is raised to the power j, with wt(j) > mi, we conclude that P{Q(a + Z)) is of the 
form X^wt(k)>mi-m2 ^kZ'^. This shows that (Po Q)^^^(a) = for each k with wt(k) < mi • m2, and 
the result follows. ■ 



Corollary 7 Let P(X) € F[X] where X = (Xi,...,X„). Lei a,b G F'^. Let Pa,h{T) be the 
polynomial P(a + T • b) G F[T] . Then for any t £ ¥, 

mult(Pa,b, t) > mult(P, a + t-h). 

Proof Let Q{T) = a + Th e F[r]". Applying the previous proposition to P(X) and Q{T), we 
get the desired claim. ■ 



2.4 Strengthening of the Schwcirtz-Zippel Lemma 

We are now ready to state and prove the strengthening of the Schwartz-Zippel lemma. In the 
standard form this lemma states that the probability that P(a) = when a is drawn uniformly 
at random from S"" is at most (i/|S'|, where P is a non-zero degree d polynomial and 5 C F is a 
finite set. Using min{l, mult(P, a)} as the indicator variable that is 1 if P(a) = 0, this lemma can 
be restated as saying ^^g^„ min{l, mult(P, a)} < d ■ \S\'^~^. Our version below strengthens this 
lemma by replacing min{l, mult(P, a)} with mult (P, a) in this inequality. 

Lemma 8 Let P G F[X] be a nonzero polynomial of total degree at most d. 
SC¥, 

mult(P,a) <d- \S\''-'^. 
Proof We prove it by induction on n. 

For the base case when n = 1, we first show that if mult (P, a) = m then {X 
To see this, note that by definition of multiplicity, we have that P(a + Z) 
p(»)(a) = for ah i < m. We conclude that divides P(a + Z), and thus {X 
It follows that J2aeS niult(P, a) is at most the degree of P. 

Now suppose n > 1. Let 

t 

P{Xi, . . . ,Xn) = ^P,(Xi, . . . ,Xn-l)Xl, 
j=0 

where < t < d, Pt{Xi, X„_i) ^ and deg(P,) <d-j. 
For any ai, . . . , a„_i G S, let mai,...,a„-i = mult(Pt, (ai, . . . , a„_i)). We will show that 

^ mult(P, (ai,...,an)) < 

fnai,...,an-i 

■\S\ + t. (2) 



Then for any finite 



- a)™ divides P(X). 
= Y.iP^'\a)Z' and 
-a)"* divides P{X). 
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Given this, we may then bound 

^ mult(P,(ai,...,a„)) < ^ ma,,...,a„_, ■ \S\ + \Sr' ■ t. 

ai,...,a„s5 ai,...,a„_i65 

By the induction hypothesis apphed to Pt, we know that 

ma„...,a^_, < deg(Pt) • \sr' <id-t). \sr\ 

ai,...,a,i_ieS 

This imphes the result. 

We now prove Equation ([2]). Fix oi, . . . , a^-i G S and let i = (ii, . . . , in-i) be such that wt(i) = 
'^ai,...,a„_i and pj^'^ (^Xi, . . . , Xji—i) 7^ 0. Letting (i,0) denote the vector (ii, . . . , z^—i, 0), we note 
that 

t 

...,x^) = Y,P^'\x,,..., 

j=0 

and hence P^^'^^ is a nonzero polynomial. 

Now by Lemma [5] and Corollary [TJ we know that 

mult(P(Xi, . . .,Xn), (ai, . . . , an)) < wt(i,0) + mult(p(='°)(Xi, . . . (ai, . . . ,a„)) 

< "T'ai,...,a„„i + mult(p(''°^(ai, . . . ,an_i,X„),a„). 

Summing this up over all a„ G S, and applying the n = 1 case of this lemma to the nonzero 
univariate degree-t polynomial P^^''^\ai, . . . ,0^-1, we get Equation ([2]). This completes the 
proof of the lemma. ■ 

The following corollary simply states the above lemma in contrapositive form, with S = ¥q. 

Corollary 9 Let P £ IF<j[X] be a polynomial of total degree at most d. If ^^^^jpn mult(P, a) > 
d-q""-^, then P{X) =0. 

3 A lower bound on the size of Kakeya sets 

We now give a lower bound on the size of Kakeya sets in F^. We implement the plan described in 
Section [TJ Specifically, in Proposition [10] we show that we can find a somewhat low degree non-zero 
polynomial that vanishes with high multiplicity on any given Kakeya set, where the degree of the 
polynomial grows with the size of the set. Next, in Claim [T2] we show that the homogenous part 
of this polynomial vanishes with fairly high multiplicity everywhere in Fg . Using the strengthened 
Schwartz-Zippel lemma, we conclude that the homogenous polynomial is identically zero if the 
Kakeya set is too small, leading to the desired contradiction. The resulting lower bound (slightly 
stronger than Theorem [1]) is given in Theorem II 1[ 
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Proposition 10 Given a set if C and non-negative integers m, d such that 

m + n—l\ , fd + n 

]-\K\<[ 
n J \ n 

there exists a non-zero polynomial P = Pm,K £ F[X] of total degree at most d such that mult(P, a) > 
m for every a G K . 

Proof The number of possible monomials in P is ('^+"). Hence there are ('^+") de ffrees of 
freedom in the choice for the coefficients for these monomials. For a given point a, the condition 
that mult(P, a) > m imposes C""^""^) homogeneous linear constraints on the coefficients of P. 
Since the total number of (homogeneous) linear constraints is " l-^l' which is strictly less 

than the number of unknowns, there is a nontrivial solution. 



Theorem 11 //if C is a Kakeya set, then \K\ > ( 2-i/g )"- 

Proof Let £ he a large multiple of q and let 

m = 2e- £/q 
d = £q-l. 

These three parameters {i, m and d) will be used as follows: d will be the bound on the degree of 
a polynomial P which vanishes on K, m will be the multiplicity of the zeros of P on if and £ will 
be the multiplicity of the zeros of the homogenous part of P which we will deduce by restricting P 
to lines passing through K. 

Note that by the choices above we have d < £q and (m — £)q > d — £. We prove below later that 

(d+n\ 

\K\ > / " \, > a" 

where a — > 2-1 /q as ^ — > 00. 

fd+n\ 

Assume for contradiction that |if| < _in . Then, by Proposition [10] there exists a non-zero 

polynomial i^(X) E F[X] of total degree exactly d* , where d* < d, such that mult(P, x) > m for 
every x E if . Note that d* > £ since d* > m (since P is nonzero and vanishes to multiplicity > m 
at some point), and m > ^ by choice of m. Let Hp(X.) be the homogeneous part of i^(X) of degree 
d* . Note that Hp(X.) is nonzero. The following claim shows that Hp vanishes to multiplicity £ at 
each point of F^ . 

Claim 12 For each b E F^. 

mult(iip,b) > £. 
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Proof Fix i with wt(i) = w < Let (5(X) = p(')(X). Let d' be the degree of the polynomial 

Q(X.), and note that d! < d* — w. 

Let a = a(b) be such that {a+tb|t G Fg} C K. Then for all t G Fg, by Lemma[5l umlt{Q, a+tb) > 
m — w. Since w < £ — 1 and (m — ^) • g > d* — £, we get that {m — w) ■ q > d* — w. 

Let Qa,b(2^) be the polynomial Q{a + Th) G FgfT]. Then Qa,hiT) is a univariate polynomial of 
degree at most d' , and by Corollary [Tj it vanishes at each point of Fg with multiplicity m — w. Since 

(m-w) -qy d* -w> deg(Qa,b(T)), 

we conclude that QaL,h{T) = 0. Hence the coefficient of T^' in Qa,biT) is 0. Let Hq be the 
homogenous component of Q of highest degree. Observe that the coefficient of T'^ in Qa,h{T) is 
Hgih). Hence ^^(b) = 0. 

However Hq(X) = (Fp)(')(X) (by item 2 of Proposition ED . Hence (ifp)(')(b) = 0. Since this is 
true for all i of weight at most ^ — 1, we conclude that mult(i/p,b) > i. M 

Applying Corollary [9l and noting that iq"^ > d*q^~^, we conclude that Hp(X.) = 0. This contradicts 
the fact that P(X) is a nonzero polynomial. 

Hence, 

\K\ > ^ " ^ 

Now, by our choice of d and m, 



Since this is true for all I such that ^ is a multiple of q, we get that 



i-^^fJl\2-l/q-l/l + i/lJ \2-l/qJ 



4 Statistical Kakeya for curves 

Next we extend the results of the previous section to a form conducive to analyze the mergers of 
Dvir and Wigderson |DW08| . The extension changes two aspects of the consideration in Kakeya 
sets, that we refer to as "statistical" and "curves" . We describe these terms below. 

In the setting of Kakeya sets we were given a set K such that for every direction, there was a line 
in that direction such that every point on the line was contained va. K. In the statistical setting 
we replace both occurrences of the "every" quantifier with a weaker "for many" quantifier. So we 
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consider sets that satisfy the condition that for many directions, there exists a hne in that direction 
intersecting K in many points. 

A second change we make is that we now consider curves of higher degree and not just hues. We 
also do not consider curves in various directions, but rather curves passing through a given set of 
special points. We start with formalizing the terms "curves", "degree" and "passing through a 
given point". 

A curve of degree A in is a tuple of polynomials C{X) = {Ci{X), . . . ,C„(X)) G Fg[X]" such 
that maxjgj„] deg(Cj(X)) = A. A curve C naturally defines a map from ¥g to . For x G F^ , we 
say that a curve C passes through x if there is a t G ¥q such that C{t) = x. 

We now state and prove our statistical version of the Kakeya theorem for curves. 

Theorem 13 (Statistical Kakeya for curves) Let X > 0,7] > 0. Let A > be an integer such 
that rjq > A. Let 5 C F^ be such that \S\ = Ag". Let AT C F^ be such that for each x G there 
exists a curve Cx of degree at most A that passes through x, and intersects K in at least rjq points. 
Then, 



\K\ > 



Xq 



In particular, if X> t] we get that | AT] > ' 



Observe that when X = r] = 1, and A = 1, we get the same bound as that for Kakeya sets as 
obtained in Theorem 111! 



Proof Let £ be a large integer and let 



d = xeq-i 



\£q-l-{£-l) „ 
m = A— ^ + £. 

m 

By our choice of m and d, we have rjq{m — {i — 1)) > A{d — {i — !))• Since rjq > A, we have that 
for all w such that < w < i — 1, r]q{m — w) > A{d — w). Just as in the proof of Theorem II H we 
will prove that 



\K\ > t-^Mt > a' 



where a — > / ^^^^ ^ 



+1 



as t — > oo. 



If possible, let [A'l < ^,„4-" _n . As before, by Proposition [TOl there exists a non-zero polynomial 

P(X) G Fg[X] of total degree d* , where d* < d, such that mult(P, a) > m for every a G AT. We 
will deduce that in fact P must vanish on all points in S with multiplicity i. We will then get the 
desired contradiction from Corollary [9l 

Claim 14 For each xq G S, 

mult(P,xo) > e. 
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Proof Fix any i with wt(i) = w<e-l. Let Q(X) = p(')(X). Note that Q(X) is a polynomial 
of degree at most d* — w. By Lemma EJ for all points a G K, mult(Q, a) > m — w. 

Let be the curve of degree A through xq, that intersects K in at least r]q points. Let to S Fg 
be such that Cxo(to) = xq. Let (5xo(^) be the polynomial Q o CxoCT") G Fq[T]. Then Qxo(^) is a 
univariate polynomial of degree at most A(d* — w). By Corollary [71 for all points t £¥q such that 
Cxo(0 £ ^) Qxo(^) vanishes at t with multiplicity m — w. Since the number of such points t is at 
least r/g, we get that (5xo(2^) has at least riq{m — w) zeros (counted with multiplicity). However, 
by our choice of parameters, we know that 

r]q{m - w) > A{d - w) > A{d* - w) > deg{Q^,,{T)). 

Since the degree of Qxo (T) is strictly less than the number of its zeros, Qxo (^) must be identically 
zero. Thus we get Qxo{to) = Q{Cxo{to)) = Qi^o) = Hence P'^')(xo) = 0. Since this is true for all 
i with wt(i) < ^ — 1, we conclude that mult(P, xq) > i. M 



Thus P vanishes at every point in S with multiplicity i. As -P(X) is a non-zero polynomial. 
Corollary [9] implies that i\S\ < d*q"~^. Hence £Xq^ < dq^~^, which contradicts the choice of d. 

Thus \K\ > 

fm+^-i\ ■ By choice of d and m, 

\ n / 

\K\ > ^ ^ 



Picking £ arbitrarily large, we conclude that 

i^i>ii,„ ..(^'""") ^li^^ \-l 



5 Improved Mergers 

In this section we state and prove our main result on randomness mergers. 
5.1 Definitions and Theorem Statement 

We start by recalling some basic quantities associated with random variables. The statistical distance 
between two random variables X and Y taking values from a finite domain Vt is defined as 

max|Pr[X G 5] - Pr[Y G 511 . 
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We say that X is e-close to Y if the statistical distance between X and Y is at most e, otherwise we 
say that X and Y are e-far. The min-entropy of a random variable X is defined as 



-f^oo(X) = min log; 



xesupp(x) \Pr[X = x 

We say that a random variable X is e-close to having min-entropy m if there exists a random 
variable Y of min-entropy m such that X is e-close to Y. 

A "merger" of randomness takes a A-tuple of random variables and "merges" their randomness to 
produce a high-entropy random variable, provided the A-tuple is "somewhere-random" as defined 
below. 



Definition 15 (Somewhere-random source) For integers A and a simple (A^, A)-somewhere- 
random source is a random variable A = (Ai, . . . , Aa) taking values in S^, where S is some finite set 
of cardinality 2^ , such that for some io G [A], the distribution of IKi^ is uniform over S. A {N,A)- 
somewhere-random source is a convex combination of simple (N, A) -somewhere-random sources. 
(When N and A are clear from context we refer to the source as simply a "somewhere-random 
source".) 



We are now ready to define a merger. 



Definition 16 (Merger) For positive integer A and set S of size 2^, a function f : S'^xjO, 1}'^ 
S is called an (m, e)-merger (of {N, A) -somewhere-random sources), if for every (A, A) somewhere- 
random source A = (Ai, . . . , Aa) taking values in S^, and for B being uniformly distributed over 
{0, 1}*^, the distribution of /((Ai, . . . , Aa), B) is e-close to having min-entropy m. 



A merger thus has five parameters associated with it: A, A, m, e and d. The general goal is 
to give explicit constructions of mergers of (A^, A)-somewhere-random sources for every choice of 
N and A, for as large an m as possible, and with e and d being as small as possible. Known 
mergers attain m = {1 — 5) ■ N for arbitrarily small 6 and our goal will be to achieve 5 = o(l) as a 
function of A^, while e is an arbitrarily small positive real number. Thus our main concern is the 
growth of d as a function of N and A. Prior to this work, the best known bounds required either 
d = r2(log A -I- log A) or d = Q.{A). We only require d = r2(log A). 



Theorem 17 For every e, (5 > and integers N, A, there exists a ((1 — 5) ■ N, e)-merger of (A, A)- 
somewhere-random sources, computable in polynomial time, with seed length 




5.2 The Curve Merger of [DW08] and its analysis 

The merger that we consider is a very simple one proposed by Dvir and Wigderson [DW08] . and 
we improve their analysis using our extended method of multiplicities. We note that they used 
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the polynomial method in their analysis; and the basic method of multiplicities doesn't seem to 
improve their analysis. 

The curve merger of [DW08] , denoted /dWj is obtained as follows. Let g > A be a prime power, 
and let n be any integer. Let 71, . . . , 7a G Fg be distinct, and let Ci{T) G Fq[T] be the unique degree 
A— 1 polynomial with Ci{ji) = 1 and for all j ^ i, Ci{-^j) = 0. Then for any x = (xi, . . . , xa) G (Fg)^ 
and u G F^, the curve merger /dw maps (F^)^ x Fg to F^ as follows: 

A 

/dw((xi, . . . ,XA),n) = ^Ci(u)xi. 

i=l 

In other words, /dw((xi, . . . ,xa),m) picks the (canonical) curve passing through xi, . . . ,xa and 
outputs the uih. point on the curve.. 

Theorem 18 Let q > A and A be somewhere-random source taking values in (F^)^. Let B be 
distributed uniformly over ¥q, with A, B independent. Let C = /dw(A, B). Then for 

C is e-close to having min-entropy (1 — 6) ■ n ■ log2 q. 

Theorem [l7] easily follows from the above. We note that |DW08] proved a similar theorem assuming 
q > poly(n, A), forcing their seed length to grow logarithmically with n as well. 

Proof of Theorem [ig Let q = 2'^,so that q> (^) ^ , and let n = N/d. Then we may identify 
identify F, with {0, l}'^ and F^ with {0, 1}^. Take / to be the function /dw 

given earlier. Clearly 

/ is computable in the claimed time. Theorem [18] shows that / has the required merger property. 



We now prove Theorem 1181 

Proof of Theorem I18t Without loss of generality, we may assume that A is a simple somewhere- 
random source. Let m = {1 — 6) ■ n ■ log2 q. We wish to show that /dw(A, B) is e-close to having 
min-entropy m. 

Suppose not. Then there is a set C F^ with \K\ < 2™ = < (||-)" such that 

Pr[/(A,B)GK]>e. 

Suppose Aj(, is uniformly distributed over F^. Let A_j(, denote the random variable 

(Ai, . . . , Ajo„i, Ajp+i, . . . , Aa). 
By an averaging argument, with probability at least A = e/2 over the choice of Aj^, we have 

_PrJ/(A,B) Gi^l >77, 
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where = e/2. Since Aj^ is uniformly distributed over F^, we conclude that there is a set S of 
cardinality at least Xq"" such that for any x £ S, 

Pr[/(A,B)Gir| A,,„=x]>r?. 

A,B 

Fixing the values of A_j(,, we conclude that for each x G 5, there is a y = y(x) = (yi, . . . , yA) with 
Yig = X such that PrB[/(y, B) G > rj. Define the degree A — 1 curve Cy:{T) = /(y(x),r) = 
Y,^=iy j'^jiT)- Then passes through x, since Cx(7io) = Y,^=iyi'^j{lio) = y»o = and 
PrBeFjCx(B) G > 7? by definition of C^. 

Thus S and K satisfy the hypothesis of Theorem [T3j We now conclude that 



This is a contradiction, and the proof of the theorem is complete. ■ 



eq/2 \\ (^Q 
A - {A-l)/i]q) ^2A 



The Somewhere-High-Entropy case: It is possible to extend the merger analysis given above 
also to the case of somewhere-high-entropy sources. In this scenario the source is comprised of 
blocks, one of which has min entropy at least r. One can then prove an analog of Theorem [18] 
saying that the output of /dw will be close to having min entropy {1 — 5) ■ r under essentially the 
same conditions on q. The proof is done by hashing the source using a random linear function into 
a smaller dimensional space and then applying Theorem [18] (in a black box manner). The reason 
why this works is that the merger commutes with the linear map (for details see |DW08| ) . 



6 Extractors with sub-linear entropy loss 

In this section we use our improved analysis of the Curve Merger to show the existence of an explicit 
extractor with logarithmic seed and sub linear entropy loss. 

We will call a random variable X distributed over {0, 1}" with min-entropy k an (n, /!;)-source. 

Definition 19 (Extractor) A function E : {0,1}" x {0,1}^^ i-^ {0,1}™- is a (/c, e) -extractor if 

for every {n,k)-source X, the distribution of E{X, U^) is e-close to uniform, where is a random 
variable distributed uniformly over {0, l}'^, and X, are independent. An extractor is called explicit 
if it can be computed in polynomial time. 

It is common to refer to the quantity k — m in the above definition as the entropy loss of the 
extractor. The next theorem asserts the existence of an explicit extractor with logarithmic seed 
and sub- linear entropy loss. 

Theorem 20 (Basic extractor with sub-linear entropy loss) For every ci > 1, for all posi- 
tive integers k < n with k > log^(n), there exists an explicit {k, e)-extractor E : {0, 1}" x {0, 1}"' i— > 
{0, 1}™ with 

d = 0{ci ■ log(n)). 
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m 



O 



O 



k ■ log log (n) 
log(n) 

1 



log*^^ (n) 



The extractor of this theorem is constructed by composing several known explicit constructions of 
pseudorandom objects with the merger of Theorem [T71 In Section [6. II we describe the construction 
of our basic extractor. We then show, in Section [6.21 how to use the 'repeated extraction' technique 
of Wigderson and Zuckerman |WZ99j to boost this extractor and reduce the entropy loss to k — m = 
0{k/ \og^ n) for any constant c (while keeping the seed logarithmic). The end result is the following 
theorem: 



Theorem 21 (Final extractor with sub-linear entropy loss) For every ci,C2 > 1, for all 
positive integers k < n, there exists an explicit {k,e)- extractor E : {0,1}" x {0,1}'^ ^ {0,1}'" 
with 

d = 0{ciC2 ■ log(n)), 
k 



k — m = O 
e = O 



log"^^ (n 
1 



log'^^ (n) 



6.1 Proof of Theorem [20] 

Note that we may equivalently view an extractor E : {0, 1}" x {0, l}'' ^ {0, 1}"^ as a randomized 
algorithm E : {0, 1}" — > {0, 1}"^ which is allowed to use d uniformly random bits. We will present 
the extractor E as such an algorithm which takes 5 major steps. 

Before giving the formal proof we give a high level description of our extractor. Our first step is to 
apply the lossless condenser of [GUV07j to output a string of length 2k with min entropy k (thus 
reducing our problem to the case k = U{n)). The construction continues along the lines of |DW08] . 
In the second step, we partition our source (now of length n' = 2k) into A = log(n) consecutive 
blocks Xi, . . . ,X\ G {0, 1}" of equal length. We then consider the A possible divisions of the 
source into a prefix of j blocks and suffix of A — j blocks for j between 1 and A. By a result 
of Ta-Shma [TS96bj . after passing to a convex combination, one of these divisions is a {k',k2) 
block source with k' being at least k — 0{k/A) and ^2 being at least poly-logarithmic in k. In the 
third step we use a block source extractor (from [RSWOOj ) on each one of the possible A divisions 
(using the same seed for each division) to obtain a somewhere random source with block length 
k' . The fourth step is to merge this somewhere random source into a single block of length k' and 
entropy k' ■ {1 — 6) with 6 sub-constant. In view of our new merger parameters, and the fact that A 
(the number of blocks) is small enough, we can get away with choosing 5 = log log (n)/ log (n) and 
keeping the seed logarithmic and the error poly-logarithmic. To finish the construction (the fifth 
step) we need to extract almost all the entropy from a source of length k' and entropy k' ■ (1 — 6). 
This can be done (using known techniques) with logarithmic seed and an additional entropy loss 
of 0(6 -k'). 
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We now formally prove Theorem 1201 We begin by reducing to the case where n = 0{k) using the 
lossless condensers of |GUV07] . 

Theorem 22 (Lossless condenser |GUV07] ) For all integers positive k < n with k = LL'(log(n)), 
there exists an explicit function Cguv '■ {0, 1}" x {0, l}'^ ^ {0, 1}" with n' = 2k, d' = 0(log(n)), 
such that for every {n, k)-source X, C(X, U^/) is {l/n)-close to an {n' , k)- source, where (Jd' is dis- 
tributed uniformly over {0, l}"^ , and X, U^' are independent. 



Step 1: Pick U^' uniformly from {0, 1}^'. Compute X' = Cguv(X, U^O- 

By the above theorem, X' is (l/n)-close to an (n', A;)-source, where n' = 2k. Our next goal is to 
produce a somewhere-block source. We now define these formally. 

Definition 23 (Block Source) Let X = (Xi,X2) be a random source over {0,1}"^ x {0,1}"^. 
We say that X is a (fci, A;2)-block source i/Xi is an {ni,ki)- source and for each xi £ {0,1}"^ the 
conditional random variable X2IX1 = xi is an (n2,k2)- source. 

Definition 24 (Somewhere-block source) Let X = (Xi, . . . , X^) be a random variable such that 
each Xj is distributed over {0, l}"-*.! x {0, 1}"».2 . We say that X is a simple {ki, fc2)-somewhere-block 
source if there exists i G [A] such that Xj is a (ki, k2)-block source. We say that X is a somewhere- 
(^1) ^2)-block source ifX is a convex combination of simple somewhere random sources. 

We now state a result of Ta-Shma |TS96bj which converts an arbitrary source into a somewhere- 
block source. This is the first step in the proof of Theorem 1 on Page 44 of |TS96bj (Theorem 
1 shows how convert any arbitrary source to a somewhere-block source, and then does more by 
showing how one could extract from such a source). 

Let A be an integer and assume for simplicity of notation that n' is divisible by A. Let 

x' = (x;,...,x^)G ({o,ir'/A)^ 

denote the partition of X' into A blocks. For every 1 < j < A we denote 

= (X'l' • • • 'Xj)' 
= (Xj+i, • • • 

Consider the function B^^ : {0, 1}"' ({0, 1}"')^' where 

b4s(X') = ((Yi, Zi), (Y2, Z2), . . . , (Ya, Za)). 
The next theorem shows that the source ((Yj, Zj))^.gj^j is close to a somewhere-block source. 

Theorem 25 ( |TS96b) ) Let A be an integer. Let k = ki + k2 + s. Then the function B^^ : 
{0, 1}"' ({0, 1}"')'^ is such that for any {n', k)-source X' , letting X" = B/^^{X'), we have that X" 
is 0{n ■ 2~^)-close to a somewhere-{ki — 0{n' / h),k2) -block source. 
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step 2: Set A = log(n). Compute X" = (X'/,X'2', • • • ,XX) = B!^^{X'). 

Plugging k2 = 0{\og^{n')) = 0{\og^{k)), s = O(logn) and ki = k — k2 — s m. the above theorem, 
we conclude that X" is n^^^^^-close to a somewhere- (fc', /c2)-block source, where 

k' = ki- 0{n/\og{n)) = k-k2-s- 0{k/ login)) = k- 0{k/log{n)), 

where for the last inequality we use the fact that k > log^{n) and so both s and k2 are bounded 
by 0(A;/log(n)). 

We next use the block source extractor from [RSWOO] to convert the above somewhere-block source 
to a somewhere-random source. 

Theorem 26 ( [RSWOO] ) Let n' = ni + n2 and let k',k2 be such that k2 > log^(ni). Then 
there exists an explicit function -Ersw : {0, 1}"^ x {0, 1}"^ x {0, l}*^ ^ {0, 1}™ with m" = k' , 
d" = 0{\og{n')) , such that for any {k' ,k2) -block source X, £'rsw(X, U^") is {ni)~^^^^ -close to the 
uniform distribution over {0, 1}™ , where U fi>r is distributed uniformly over 

{0,lY", andX,\J ri" are 

independent. 

Set d" = 0{log{n')) as in Theorem [26l 
Step 3: Pick U^" uniformly from {0, 1}'^". For each j e [A], compute X"' = £;rsw(XJ, Ud")- 

By the above theorem, X'" is n' -close to a somewhere-random source. We are now ready to use 
the merger M from Theorem 1171 We invoke that theorem with entropy-loss 8 = loglog(n)/log(n) 
and error e = ipgci ; and hence M has a seed length of 

d'" = 0{-Aog-) = 0{ci log(n)). 
e 



Step 4: Pick Ud"/ uniformly from {0, 1}'^"'. Compute X"" = M(X'", U^///). 
By Theorem dZl X"" is O L cw J -close to a ik', (1 - (5)A;')-source. Note that 5 = oil), and thus 

log yn) 

X"" has nearly full entropy. We now apply an extractor for sources with extremely-high entropy 
rate, given by the following lemma. 

Lemma 27 For any k' and 6 > 0, there exists an explicit {k'{l — 5), k'~^^^^)- extractor Shigh : 
{0, 1}'^' X {0, lY"" ^ {0, l}(i-35)fc' with d"" = 0(log{k')). 

The proof of this lemma follows easily from Theorem [26j Roughly speaking, the input is partitioned 
into blocks of length k' — 6k — log^ k' and 5k' + log^ k' . It follows that this partition is close to a 
{k' {1 — 25) — log^ /c', log^ A:')-block source. This block source is then passed through the block-source 
extractor of Theorem [26l 

Step 5: Pick uniformly from {0, lY"" ■ Compute X'"" = £;high(X"", Ud"")- Output X'"" . 
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This completes the description of the extractor E. It remains to note that d, the total number 
of random bits used, is at most d' + d" + d'" + d"" = O(cilogn), and that the output X'"" is 
0([^;gJ]-^)-close to uniformly distributed over 

This completes the proof of Theorem [20l 

We summarize the transformations in the following table: 



Function 


Seed length 


Input-type 


Output-type 


Cguv 

"ts 
-E'rsw 
M 

-Ehigh 


0(log(n)) 


0(log(A;)) 
0(log(n)) 
0(log(A;)) 


(n, /c)-source 
{2k, A;)-source 
somewhere- (/c', log^(A;))-block 
{k' , 0(log(n)))-somewhere-random 
{k' , k' — o(A;))-source 


{2k, k)-source 
somewhere-(/c', log^(A;))-block 
{k' , 0(log(n)))-somewhere-random 
{k' , k' — o(fc))-source 

Ufc'-o(fc) 



6.2 Improving the output length by repeated extraction 



We now use some ideas from |RSW00j and |WZ99j to extract an even larger fraction of the min- 
entropy out of the source. This will prove Theorem [2TJ We first prove a variant of the theorem with 
a restriction on k. This restriction will be later removed using known constructions of extractors 
for low min-entropy. 



Theorem 28 (Explicit extractor with improved sub-linear entropy loss) For every ci,C2 > 
1, for all positive integers k < n with k = log'^^^^(n), there exists an explicit {k,e)- extractor 
E : {0, 1}" X {0, 1}'^ ^ {0, 1}"* with 

d = 0{ciC2 ■ log(n)), 
/ k 

k — m = O 
e = O 



\og^-'{n) J ' 
1 



log*^^ (n) 



We first transform the extractor given in Theorem into a strong extractor (defined below) via 
[RSWOOt Theorem 8.2] (which gives a generic way of getting a strong extractor from any extractor). 
We then use a trick from [WZ99j that repeatedy uses the same extractor with independent seeds 
to extract the 'remaining entropy' from the source, thus improving the entropy loss. 



Definition 29 A {k, e) -extractor E : {0, 1}" x {0, l}*^ i— > {0, 1}™" is strong if for every {n, k)-source 
X, the distribution of {E{X, U^) is e-close to the uniform distribution over {0,1}™+'^, where 
is distributed uniformly over {0, l}'^, and X, are independent. 
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Theorem 30 r [RSWOO|, Theorem 8.2]) Any explicit (/c, e) -extractor E : {0,1}"' x {0,1}"' ^ 
{0,1}™ can be transformed into an explicit strong {k,0{y/e)) -extractor E' : {0,1}" x {0,1}*^^'^) ^ 
{0, i}™-'i-2iog(i/€)-0(i)_ 

Theorem 31 r |WZ99L Lemma 2.4]) Let Ei : {0, 1}" x {0, lY^ ^ {0, l}™i be an explicit strong 
{k, ei) -extractor, and let E2 : {0, 1}" x {0, l}'^^ ^ ]^|m2 explicit strong {k — (mi + r), 62)- 

extractor. Then the function 

E3 : {0, 1}" X (^{0, l}'^^ X {0, lY^^ ^ {0, 

defined by 

E3{x,yi,y2) = Ei{x,yi) o E2{x,y2) 
is a strong {k,ei + €2 + 2"'') -extractor. 



We can now prove Theorem 1281 Let E be the {k, e)-extractor with seed 0(ci logn) of Theorem 1201 
By Theorem 1301 we get an exphcit strong (/c, -y/e)-extractor E' with entropy loss 0(fc ^°^^^" ). 

We now iteratively apply Theorem [31] as fohows. Let E^^^ = E' . For each 1 < i < 0(c2), let 
E^^^ : {0,1}" X {0, l}"** {0,1}™' be the strong (A;, ej)-extractor produced by Theorem [3T] when 
we take Ei = and E2 to be the strong {k — mj_i — ci logn, 1/ log'^^(n))-extractor with seed 

length 0(ci logn) given by Theorem 1201 and Theorem [30l Thus, 

di = 0{ici logn). 
ei = 

Vlog"'(nj y 

log log n 
log n 



rui = mj_i + {k — nii-i — ci logn) [ 1 — O 
Thus the entropy loss of E^^^ is given by: 



k-m, = {k- mi.i) ( 1 - ( 1 - O ( l^gl^^^^ + o{ci logn) = O ^ ^ 



logn JJJ Vlog*("-) 



]^{0{c2)) jg ^]^g desired extractor. ■ 

Remark In fact [GUVOTj and |RRV99] show how to extract all the minentropy with polyloga- 
rithmic seed length. Combined with the lossless condenser of [GUVOTj this gives an extractor that 
uses logarithmic seed to extract all the minentropy from sources that have minetropy rate at most 

20(Vlogn)^ 



Theorem 32 (Corollary of jGUVOTl Theorem 4.21]) For all positive integers n > k such 
that k = 2'^(^^°§ and for all e > there exists an explicit (k, e)-extractor E : {0, 1}" x {0, l}'^ ^ 
{0,1}™ with d = 0{log{n)) and m = k + d - 2\og{l/e) - 0(1). 

This result combined with Theorem [28] gives an extractor with improved sub-linear entropy loss 
that works for sources of all entropy rates, thus completing the proof of Theorem 1211 



22 



7 Bounds on the list size for list-decoding Reed-Solomon codes 

In this section, we give a simple algebraic proof of an upper bound on the list size for list-decoding 
Reed-Solomon codes within the Johnson radius. 

Before stating and proving the theorem, we need some definitions. For a bivariate polynomial 
P{X, Y) £ ¥[X, Y], we define its (a, 6)-degree to be the maximum of ai + bj over all (i, j) such that 
the monomial X^Y^ appears in P{X, Y) with a nonzero coefficient. Let N(k, d, 9) be the number 
of monomials X'^Y^ which have (1, /c)-degree at most d and j < 9d/k. We have the following simple 
fact. 

Fact 33 For any k < d and 6 G [0, 1], N{k,d,e) > 9 - {2-9) - ^. 

Now we prove the main theorem of this section. The proof is an enhancement of the original 
analysis of the Guruswami-Sudan algorithm using the extended method of multiplicities. 



Theorem 34 (List size bound for Reed-Solomon codes) Let (ai,/9i), . . . , (a„,/3„) S F^. Let 
-R, 7 E [0, 1] with 7^ > R. Let k = Rn. Let fi{X), . . . , fhiX) G F[X] he polynomials of degree at 
most k, such that for each j £ [L] we have \{i £ [n] : fj{oti) = [5i}\ > jn. Then L < -r^- 



Proof Let e > be a parameter. Let 9 = — Let m be a large integer (to be chosen later), 



and let d = {1 + e) ■ m ■ y g.(2-6>) • interpolate a nonzero polynomial P{X^Y) S F[X, y] 

of (1, /c)-degree at most d and F-degree at most 9d/k, that vanishes with multiplicity at least m 
at each of the points {ai,Pi). Such a polynomial exists if N{k,d,9), the number of monomials 
available, is larger than the number of homogeneous linear constraints imposed by the vanishing 
conditions: 

m(m +1) , „^ 

^ ^ ' ■n<N{k,d,9). (3) 

This can be made to hold by picking m sufficiently large, since by Fact [331 

N{k,d,9)>9-{2-9)^= ^^^f'^' -n. 

Having obtained the polynomial P{X,Y), we also view it as a univariate polynomial Q(Y) S 
F(X)[y] with coefficients in, ¥{X), the field of rational functions in X. 

Now let f{X) be any polynomial of degree at most k such that, letting I = {i G [n] : f{ai) = 
\I\ > A. We claim that the polynomial Q(Y) vanishes at f{X) with multiplicity at least m — d/A. 
Indeed, fix an integer j <m- d/A, and let Rj{X) = Q^^\f{X)) = P^°^^\X, f{X)). Notice the 
degree of Rj{X) is at most d. By Proposition [6] and Lemma O 

mult(i?j, ai) > mult(p(°'^), (ai, A)) > mult(P, (a^, /3i)) - j. 

Thus 

mult(i?j, ai) > \L\ ■ {m — j) > A ■ {m — j) > d. 
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By Lemma El we conclude that Rj{X) = 0. Since this holds for every j < m — d/A, we conclude 
that mult((5, f{X)) >m- d/A. 

We now complete the proof of the theorem. By the above discussion, for each j G [L], we know that 
mult(Q, fj{X)) > m — Thus, by Lemma [8] (applied to the nonzero polynomial Q{Y) G F(X)[y] 
and the set of evaluation points S = {fj{X) : j £ [L]}) 

deg(Q) > J2 mult(g,/(X)) yfrn-^Yl. 
Since deg((5) < Odjk, we get, 

Qdlk > (m- — ] ■ L. 
Using d = (1 + e) • m • yfe^^W) 6 = we get, 

^ ^ e e_ 1 1 

TT^V'^ - (2-6*) - ^ TT^V'^d - l) - ^ T+-e~{l + ^) 
Letting e ^ 0, we get L < -ttr; as desired. ■ 
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